Introduction

This documentation describes how to set up Alpine Linux on a fully encrypted disk (apart from the bootloader's partition). We will have an LVM container installed inside an encrypted partition. To encrypt the partition containing the LVM volume group, dm-crypt (which is managed by the cryptsetup command) and its LUKS subsystem is used.

Note that your /boot/ partition must be non-encrypted to work with Syslinux. When using GRUB2 it is possible to boot from an encrypted partition to provide a layer of protection from Evil Maid attacks, but Syslinux doesn't support this.

Storage Device Name

To find your storage device's name, you could either install util-linux (apk add util-linux) and find your device using the lspci command, or you could make an educated guess by using BusyBox's blkid and df commands, and running ls /dev/sd* if you are installing to a USB, SATA or SCSI device, ls /dev/fd* for floppy disks and ls /dev/hd* for IDE (PATA) devices.

The following documentation uses the /dev/sda device as installation destination. If your environment uses a different device name for your storage device, use the corresponding device names in the examples.

Setting up Alpine Linux Using LVM on Top of a LUKS Partition

To install Alpine Linux in logical volumes running on top of a LUKS encrypted partition, you cannot use the official installation procedure. The installation requires several manual steps you must run in the Alpine Linux Live CD environment.

Preparing the Temporary Installation Environment

Before you begin to install Alpine Linux, prepare the temporary environment:

Boot the latest Alpine Linux Installation CD. At the login prompt, use the root user without a password to log in. Now we will follow the Setup-alpine script and make our changes along the way.

Note: In order to setup GRUB with UEFI, you are required to use the edge branch with the main and community repository. The reason for this is that efibootmgr is not available in the stable branch. If you do not want to switch completely over to edge you can do something called repository pinning. You will need to do this after the setup-apkrepos step.

# setup-apkrepos
# apk update
# setup-sshd
# setup-ntp

Now we will deviate from the install script.

Install the following packages required to set up LVM and LUKS:

Note: The parted partition editor is needed for advanced partitioning and GPT disklabels. BusyBox fdisk is a very stripped-down version with minimal functionality

# apk add lvm2 cryptsetup e2fsprogs parted

Optionally, if you want to overwrite your storage with random data first, install haveged, which is a random number generator based on hardware events and has a higher throughput than /dev/urandom:

# apk add haveged
# rc-service haveged start

Creating the Partition Layout

BIOS/MBR with DOS disklabel

We will be partitioning the storage device with a non-encrypted /boot partition for use with the Syslinux bootloader. Syslinux is meant for use with legacy BIOS and the MSDOS MBR partition table. Syslinux does support GPT partition tables but GRUB2 is the better option for UEFI.

UEFI with GPT disklabel

We will be encrypting the whole disk but the EFI system partition mounted at /boot/efi. This means that GRUB2 will decrypt the LUKS volume and load the kernel from there, preventing someone with physical access to your computer from maliciously installing a rootkit (or bootkit) in your boot partition while your computer is not already unlocked. The partitioning scheme will look like this:

Optional: Overwrite LUKS Partition with Random Data

This should be done if your hard drive wasn't encrypted previously. It helps purge old, non-encrypted data and makes it harder for an attacker to work out how much data you have on your drive if they have access to the encrypted contents.

We will be using haveged as it is considerably faster than /dev/urandom when generating pseudo-random numbers (it's almost as high as /dev/zero in throughput), and is (supposedly) very close to truly random.

# haveged -n 0 | dd of=/dev/sda2

Encrypting the LVM Physical Volume Partition

To encrypt the partition which will later contain the LVM PV, you could either use the default settings (aes-xts-plain64 cipher with 256-bit key and Argon2 hashing with iter-time 2000ms), or you could use these settings which have added security with the trade-off being a non-noticeable decrease in performance in modern computers:

LV Creation fro BIOS/MBR

This will create a 2GB swap partition and a root partition which takes up the rest of the space. This setup is for those who do not need to use the hibernate/suspend to disk state. If you do need to suspend to disk, create a swap partition slightly larger than the size of your RAM (change the size after # lvcreate -L).

# lvcreate -L 2G vg0 -n swap
# lvcreate -l 100%FREE vg0 -n root

The LVs created in the previous steps are automatically marked active. To verify, enter:

# lvscan

LV Creation for UEFI/GPT

This will create a 2GB swap partition, a 2GB boot partition and a root partition which takes up the rest of the space. This setup is for those who do not need to use the hibernate/suspend to disk state. If you do need to suspend to disk, create a swap partition slightly larger than the size of your RAM (change the size after # lvcreate -L).

Installing Alpine Linux

In this step you will install Alpine Linux in the /mnt/ directory, which contains the mounted file system structure:

# setup-disk -m sys /mnt/

The installer downloads the latest packages to install the base installation. Additionally, the installer automatically creates the entries for the mount points in /etc/fstab file, which is currently mounted in the /mnt/ directory.

Note: The automatic writing of the master boot record (MBR) fails in this step. You will write the MBR later manually to the disk.

To get the UUID of your storage device into a file for later use, use this command:

# blkid -s UUID -o value /dev/sda2 > ~/uuid

To enable the operating system to decrypt the PV at boot time, create the /mnt/etc/crypttab file. Enter the following line into the file to decrypt the /dev/sda2 partition using the luks module and map it to the lvmcrypt name:

lvmcrypt UUID=<UUID> none luks

Tip: To easily read the UUID into this file so you don't have to type it manually, open it in vi, then type :r ~/uuid to load the UUID onto a new line.

Note: To enable TRIM append discard after luks in /mnt/etc/crypttab (coma separated). If LVM is being used you'll also need to change issue_discards to equal 1 in /mnt/etc/lvm.conf. You will then want to add a cron job for /sbin/fstrim to run periodically. Be aware that there are security risks involved when enabling TRIM with LUKS.

The swap LV is not automatically added to the fstab file. To add it manually, add the following line to the /mnt/etc/fstab file:

/dev/vg0/swap swap swap defaults 0 0

Edit the /mnt/etc/mkinitfs/mkinitfs.conf file and append the cryptsetup module to the features parameter:

features="... cryptsetup"

Note: Alpine Linux uses the en-us keyboard mapping by default when prompting for the password to decrypt the partition at boot time. If you changed the keyboard mapping in the temporary environment and want to use it at the boot password prompt, be sure to also add the keymap feature to the list above.

Note: Check the output of mkinitfs -L and add the features necessary for your system to boot. You may need to add kms in order to see a password prompt at boot.

The command uses the settings from the mkinitfs.conf file set in the -c parameter to generate the RAM disk. The command is executed in the /mnt/ directory and the RAM disk is generated using the modules for the installed kernel. Without setting the kernel version using the $(ls /mnt/lib/modules/) option, mkinitfs tries to generate the RAM disk using the kernel version installed in the temporary environment, which can differ from the latest one installed by the setup-disk utility.

Installing a bootloader

Syslinux with BIOS

Install the Syslinux package:

# apk add syslinux

Edit /mnt/etc/update-extlinux.conf and append the following kernel options to the default_kernel_opts parameter, replacing <UUID> with the UUID of /dev/sda2:

default_kernel_opts="... cryptroot=UUID=<UUID> cryptdm=lvmcrypt"

The cryptroot parameter sets the name of the device that contains the root file system, and the cryptdm parameter sets the name of the mapping previously set in crypttab.

Because the update-extlinux utility operates only on the /boot/ directory, temporarily change the root to the /mnt/ directory and update the boot loader configuration:

# chroot /mnt/
# update-extlinux
# exit

If an error occurs in the update-extlinux command you can most likely ignore it.

Verify that you run the steps described in the Installing Alpine Linux section correctly. Update the configuration if necessary, unmount the partitions, then reboot.

System can't find boot device

This can be because you are using a GPT partition table on a motherboard that runs BIOS instead of UEFI, or you are running an MSDOS/MBR/Syslinux install without enabling legacy boot mode in the UEFI settings.

Secure boot

If secure boot complains of an unsigned bootloader, you can either disable it or adapt this guide to sign GRUB. If you're using Syslinux, then secure boot should be automatically disabled when you enable legacy boot mode.

Hardening

To harden, you should disable DMA[1] and install a hardened version of AES (TRESOR[2] or Loop-Amnesia[3]) since by default cryptsetup with luks uses AES by default.

Disable DMA in the BIOS and set the password for the BIOS according to Wikipedia.[4]